CVE-2025-70516

CVSS 9.1 (critical) · published 2026-10-07

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

Weakness: CWE-306

Source: NVD CVE-2025-70516

References

• http://download.fanvil.com/Firmware/Release/X7A/
• https://www.darkpoint.ca/blog/2026/02/27/Fanvil-x7a-PA2S-Vulnerability-Disclosure
• https://www.fanvil.com/products/p1/x/20210921/5043.html

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.